1 ;;; url-http-ntlm.el --- NTLM authentication for the url library
3 ;; Copyright (C) 2008 Tom Schutzer-Weissmann
5 ;; Author: Tom Schutzer-Weissmann <tom@schutzer-weissmann.net>
6 ;; Keywords: comm, data, processes, hypermedia
8 ;; This program is free software; you can redistribute it and/or modify
9 ;; it under the terms of the GNU General Public License as published by
10 ;; the Free Software Foundation, either version 3 of the License, or
11 ;; (at your option) any later version.
13 ;; This program is distributed in the hope that it will be useful,
14 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
15 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 ;; GNU General Public License for more details.
18 ;; You should have received a copy of the GNU General Public License
19 ;; along with this program. If not, see <http://www.gnu.org/licenses/>.
23 ;; This package provides a NTLM handler for the URL package.
24 ;; It supports one username and password per server.
28 ;; Add the directory containing this file to the load path and then load the url-http-ntlm
29 ;; package. One way would be to add something like the lines below to your .emacs file:
31 ;; (add-to-list 'load-path ".emacs.d/url-http-ntlm")
32 ;; (require 'url-http-ntlm)
36 ;; Taro Kawagishi <tarok@transpulse.org> wrote ntlm.el and md4.el, which are parts of FLIM
37 ;; (Faithful Library about Internet Message).
39 ;; http://stuff.mit.edu/afs/sipb/contrib/emacs/packages/flim-1.14.7/ntlm.el
40 ;; http://stuff.mit.edu/afs/sipb/contrib/emacs/packages/flim-1.14.7/md4.el
49 (defvar url-http-ntlm-auth-storage nil
50 "Authentication storage. An alist that maps a server name
51 to a pair of \(<username> <ntlm hashes>\).
53 The hashes are built using `ntlm-get-password-hashes'.
54 The username can contain the domain name, in the form \"user@domain\".
56 Note that for any server, only one user and password is ever stored.")
58 (defun url-ntlm-auth (url &optional prompt overwrite realm args)
59 "Get the contents of the Authorization header for a HTTP
60 response using NTLM authentication, to access URL. Because
61 NTLM is a two-step process, this function expects to be called
62 twice, first to generate the NTLM type 1 message (request),
63 then to respond to the server's type 2 message (challenge) with
66 PROMPT, OVERWRITE, and REALM are ignored.
68 ARGS is expected to contain the WWW-Authentication header from
69 the server's last response. These are used by
70 `url-http-get-stage' to determine what stage we are at."
71 (url-ntlm-ensure-keepalive)
72 (let ((stage (url-ntlm-get-stage args)))
75 ;; NTLM Type 1 message: the request
77 (destructuring-bind (&optional server user hash)
78 (url-http-ntlm-authorisation url)
80 (url-http-ntlm-string (ntlm-build-auth-request user server)))))
82 ;; NTLM Type 3 message: the response
84 (let ((challenge (url-http-ntlm-get-challenge)))
85 (destructuring-bind (server user hash)
86 (url-http-ntlm-authorisation url)
87 (url-http-ntlm-string (ntlm-build-auth-response challenge
91 (url-http-ntlm-authorisation url :clear)))))
94 (defun url-ntlm-ensure-keepalive ()
95 (assert url-http-attempt-keepalives
97 "NTLM authentication won't work unless `url-http-attempt-keepalives' is set!"))
100 (defun url-ntlm-clean-headers ()
101 (setq url-http-extra-headers
102 (url-http-ntlm-rmssoc "Authorization" url-http-extra-headers)))
105 (defvar url-ntlm-last-args nil
106 "Stores the last ARGS argument to `url-ntlm-get-stage' and the return value. This is
107 used to detect multiple calls.")
108 (make-variable-buffer-local 'url-ntlm-last-args)
111 (defun url-ntlm-get-stage (args)
112 "Determine what stage of the NTLM handshake we are at.
114 PROMPT and ARGS come from `url-ntlm-auth''s caller, `url-get-authentication'. Their
115 meaning depends on the current implementation - this function is well and truly coupled...
117 url-get-authentication' calls `url-ntlm-auth' once when checking what authentication
118 schemes are supported (PROMPT and ARGS are nil), and then twice for every stage of the
119 handshake: the first time PROMPT is nil, the second, t; ARGS contains the server
120 response's \"WWW-Authenticate\" header, munged by `url-parse-args'."
121 (let* ((response-rxp "^NTLM TlRMTVNTUAADAAA")
122 (challenge-rxp "^TLRMTVNTUAACAAA")
123 (auth-header (assoc "Authorization" url-http-extra-headers))
126 (if (eq args (car url-ntlm-last-args))
127 ;; multiple calls, return the same argument we returned last time
128 (cdr url-ntlm-last-args)
131 (cond ((and auth-header (string-match response-rxp (cdr auth-header)))
133 ((and (= (length args) 2)
134 (destructuring-bind (challenge ntlm) args
135 (and (string-equal "ntlm" (car ntlm))
136 (string-match challenge-rxp (car challenge)))))
140 (url-ntlm-clean-headers)
141 (setq url-ntlm-last-args (cons args stage))
145 (defun url-http-ntlm-authorisation (url &optional clear)
146 "Get or clear NTLM authentication details for URL. If CLEAR is
147 non-nil, clear any saved credentials for server. Otherwise,
148 return the credentials, prompting the user if necessary.
150 If URL contains a username and a password, they are used and
151 stored credentials are not affected.
153 Note that for any server, only one user and password is ever
155 (let* ((href (if (stringp url)
156 (url-generic-parse-url url)
158 (server (url-host href))
159 (user (url-user href))
160 (pass (url-password href))
161 (stored (assoc server url-http-ntlm-auth-storage))
162 (both (and user pass)))
166 (setq url-http-ntlm-auth-storage
167 (url-http-ntlm-rmssoc server url-http-ntlm-auth-storage))
171 (and stored user (not (equal user (second stored))))
173 (let* ((user* (if both
175 (read-string (url-auth-user-prompt url realm)
176 (or user (user-real-login-name)))))
179 (read-passwd "Password: ")))
180 (entry `(,server . (,user* ,(ntlm-get-password-hashes pass*)))))
182 (setq url-http-ntlm-auth-storage
184 (url-http-ntlm-rmssoc server url-http-ntlm-auth-storage))))
190 (defun url-http-ntlm-get-challenge ()
191 "Return the NTLM Type-2 message in the WWW-Authenticate header,
194 (mail-narrow-to-head)
195 (let ((www-authenticate (mail-fetch-field "www-authenticate")))
196 (when (string-match "NTLM\\s-+\\(\\S-+\\)"
198 (base64-decode-string (match-string 1 www-authenticate))))))
201 (defun url-http-ntlm-rmssoc (key alist)
202 (remove* key alist :key 'car :test 'equal))
205 (defun url-http-ntlm-string (data)
206 (concat "NTLM " (base64-encode-string data :nobreak)))
209 (url-register-auth-scheme "ntlm" nil 8)
212 (provide 'url-http-ntlm)
213 ;;; url-http-ntlm.el ends here